mirror of
https://github.com/snapotter-hq/SnapOtter.git
synced 2026-08-03 07:46:42 +02:00
04ef1141fb5abe9aa2c70b737dbce77731fa4c58
139
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 SnapOtterandGitHub
|
5f21588f6c |
chore: prepare the 2.2.0 release (#660)
Bumps every version surface to 2.2.0, fixes a latent version-coupling bug in the OCR runtime tests, and stops an absent GPU runner from silently stalling a release. Version surfaces: scripts/sync-version.sh covers the 11 workspaces, APP_VERSION, and the docs release commands across all locales. Root package.json plus the three surfaces the script never reaches are done by hand: the DOCKERHUB.md banner and tag table, the docker-tags.md pinning table in 21 locales, and the example runtimeVersion in tools/image/ocr.md in 21 locales. The release-notes archive step is deliberately not pre-run, so the notes text stays editable until the release. Latent bug: runtime-state rejects any runtime whose compatibility.snapotterVersion is not exactly APP_VERSION, and five fixtures pinned the literal 2.1.0. Since semantic-release rewrites APP_VERSION on every release, the first PR after any bump would have gone red for a reason nobody would trace to the release. The fixtures now derive from APP_VERSION. GPU runner: sign-ocr-index needs verify-ocr-nvidia on self-hosted hardware, and the gated manifest job needs ai-bundles, so a missing runner queued instead of failing and produced no image tags. preflight-gpu-runner claims the same labels with no dependencies, so it is scheduled first and validates the GPU before the 90-minute build. An API preflight is impossible because listing self-hosted runners needs Administration:read, which GITHUB_TOKEN cannot hold, so RELEASE.md carries the maintainer-side check. |
||
|
SnapOtterandGitHub
|
d10d0f544f |
fix: release QA hardening across processing, media, security, and CI gates (#649)
A release-readiness QA pass over the whole product. The commits split into defects a user would hit and gates that were reporting green while measuring nothing. ## Fixes that change behaviour Rate limiting was bypassable on every install: TRUST_PROXY defaulted to true, so request.ip came from a client-set header and a forged X-Forwarded-For got past the login limiter. The default is now a private-network trust list. A transient Postgres outage stranded in-flight jobs, leaving finished output on disk with no row pointing at it. A reconciler now resolves those rows and adopts the bytes rather than dropping the work. A Redis connection that moved to a new address wedged every read-blocked consumer, so completions stopped signalling while health still answered 200. Socket timeouts plus subscriber pings recover it. Installing more than one AI bundle left the shared venv multi-versioned and silently broke three tools. The installer now reconciles distributions to one version each. Converting an image to JXL at quality 1 through 4 returned a 500, because libjxl 0.7 rejects the distance those values compute. The quality is floored at what the encoder honours. A missing ffmpeg was also reported to the user as a corrupt upload; it now says the engine is unavailable. RAW uploads reached an unpatched LibRaw on arm64, so it is built from source at 0.22.2, and the release scan was split so it can fail on an unfixed critical instead of hiding it behind ignore-unfixed. ## Gates that could not fail Two mutation lanes ran zero mutants because Stryker crawled the gitignored docs build; coverage discarded its whole report on any failing test; the lint gate skipped root tests, scripts, and two workspaces; and several generated matrices counted a host missing ffmpeg as a passing tool. Each now measures what it claims. Full evidence and the outstanding release items are tracked locally and are not part of this branch. |
||
|
|
16d8891fd5 |
chore(deps): bump the production-deps group with 15 updates (#585)
Bumps the production-deps group with 15 updates: | Package | From | To | | --- | --- | --- | | [@fastify/cookie](https://github.com/fastify/fastify-cookie) | `11.1.1` | `11.1.2` | | [@scalar/fastify-api-reference](https://github.com/scalar/scalar/tree/HEAD/integrations/fastify) | `1.62.5` | `1.62.9` | | [@sentry/node](https://github.com/getsentry/sentry-javascript) | `10.65.0` | `10.66.0` | | [bullmq](https://github.com/taskforcesh/bullmq) | `5.80.2` | `5.80.9` | | [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) | `5.10.0` | `5.10.1` | | [posthog-node](https://github.com/PostHog/posthog-js/tree/HEAD/packages/node) | `5.41.0` | `5.45.2` | | [zxing-wasm](https://github.com/Sec-ant/zxing-wasm) | `3.1.1` | `3.1.2` | | [lucide](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide) | `1.24.0` | `1.25.0` | | [@sentry/react](https://github.com/getsentry/sentry-javascript) | `10.65.0` | `10.66.0` | | [fuse.js](https://github.com/krisk/Fuse) | `7.4.2` | `7.5.0` | | [posthog-js](https://github.com/PostHog/posthog-js) | `1.399.2` | `1.404.1` | | [react-colorful](https://github.com/omgovich/react-colorful) | `5.7.0` | `5.8.0` | | [wavesurfer.js](https://github.com/katspaugh/wavesurfer.js) | `7.12.10` | `7.12.11` | | [@aws-sdk/client-s3](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3) | `3.1085.0` | `3.1090.0` | | [@aws-sdk/lib-storage](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/lib/lib-storage) | `3.1085.0` | `3.1090.0` | Updates `@fastify/cookie` from 11.1.1 to 11.1.2 - [Release notes](https://github.com/fastify/fastify-cookie/releases) - [Commits](https://github.com/fastify/fastify-cookie/compare/v11.1.1...v11.1.2) Updates `@scalar/fastify-api-reference` from 1.62.5 to 1.62.9 - [Release notes](https://github.com/scalar/scalar/releases) - [Changelog](https://github.com/scalar/scalar/blob/main/integrations/fastify/CHANGELOG.md) - [Commits](https://github.com/scalar/scalar/commits/HEAD/integrations/fastify) Updates `@sentry/node` from 10.65.0 to 10.66.0 - [Release notes](https://github.com/getsentry/sentry-javascript/releases) - [Changelog](https://github.com/getsentry/sentry-javascript/blob/develop/CHANGELOG.md) - [Commits](https://github.com/getsentry/sentry-javascript/compare/10.65.0...10.66.0) Updates `bullmq` from 5.80.2 to 5.80.9 - [Release notes](https://github.com/taskforcesh/bullmq/releases) - [Commits](https://github.com/taskforcesh/bullmq/compare/v5.80.2...v5.80.9) Updates `fast-xml-parser` from 5.10.0 to 5.10.1 - [Release notes](https://github.com/NaturalIntelligence/fast-xml-parser/releases) - [Changelog](https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/CHANGELOG.md) - [Commits](https://github.com/NaturalIntelligence/fast-xml-parser/compare/v5.10.0...v5.10.1) Updates `posthog-node` from 5.41.0 to 5.45.2 - [Release notes](https://github.com/PostHog/posthog-js/releases) - [Changelog](https://github.com/PostHog/posthog-js/blob/main/packages/node/CHANGELOG.md) - [Commits](https://github.com/PostHog/posthog-js/commits/posthog-node@5.45.2/packages/node) Updates `zxing-wasm` from 3.1.1 to 3.1.2 - [Release notes](https://github.com/Sec-ant/zxing-wasm/releases) - [Changelog](https://github.com/Sec-ant/zxing-wasm/blob/main/CHANGELOG.md) - [Commits](https://github.com/Sec-ant/zxing-wasm/compare/v3.1.1...v3.1.2) Updates `lucide` from 1.24.0 to 1.25.0 - [Release notes](https://github.com/lucide-icons/lucide/releases) - [Commits](https://github.com/lucide-icons/lucide/commits/1.25.0/packages/lucide) Updates `@sentry/react` from 10.65.0 to 10.66.0 - [Release notes](https://github.com/getsentry/sentry-javascript/releases) - [Changelog](https://github.com/getsentry/sentry-javascript/blob/develop/CHANGELOG.md) - [Commits](https://github.com/getsentry/sentry-javascript/compare/10.65.0...10.66.0) Updates `fuse.js` from 7.4.2 to 7.5.0 - [Release notes](https://github.com/krisk/Fuse/releases) - [Changelog](https://github.com/krisk/Fuse/blob/main/CHANGELOG.md) - [Commits](https://github.com/krisk/Fuse/compare/v7.4.2...v7.5.0) Updates `posthog-js` from 1.399.2 to 1.404.1 - [Release notes](https://github.com/PostHog/posthog-js/releases) - [Changelog](https://github.com/PostHog/posthog-js/blob/main/CHANGELOG.md) - [Commits](https://github.com/PostHog/posthog-js/compare/posthog-js@1.399.2...posthog-js@1.404.1) Updates `react-colorful` from 5.7.0 to 5.8.0 - [Release notes](https://github.com/omgovich/react-colorful/releases) - [Changelog](https://github.com/omgovich/react-colorful/blob/master/CHANGELOG.md) - [Commits](https://github.com/omgovich/react-colorful/compare/5.7.0...v5.8.0) Updates `wavesurfer.js` from 7.12.10 to 7.12.11 - [Release notes](https://github.com/katspaugh/wavesurfer.js/releases) - [Commits](https://github.com/katspaugh/wavesurfer.js/compare/7.12.10...7.12.11) Updates `@aws-sdk/client-s3` from 3.1085.0 to 3.1090.0 - [Release notes](https://github.com/aws/aws-sdk-js-v3/releases) - [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-s3/CHANGELOG.md) - [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1090.0/clients/client-s3) Updates `@aws-sdk/lib-storage` from 3.1085.0 to 3.1090.0 - [Release notes](https://github.com/aws/aws-sdk-js-v3/releases) - [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/lib/lib-storage/CHANGELOG.md) - [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1090.0/lib/lib-storage) --- updated-dependencies: - dependency-name: "@fastify/cookie" dependency-version: 11.1.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-deps - dependency-name: "@scalar/fastify-api-reference" dependency-version: 1.62.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-deps - dependency-name: "@sentry/node" dependency-version: 10.66.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-deps - dependency-name: bullmq dependency-version: 5.80.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-deps - dependency-name: fast-xml-parser dependency-version: 5.10.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-deps - dependency-name: posthog-node dependency-version: 5.45.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-deps - dependency-name: zxing-wasm dependency-version: 3.1.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-deps - dependency-name: lucide dependency-version: 1.25.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-deps - dependency-name: "@sentry/react" dependency-version: 10.66.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-deps - dependency-name: fuse.js dependency-version: 7.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-deps - dependency-name: posthog-js dependency-version: 1.404.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-deps - dependency-name: react-colorful dependency-version: 5.8.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-deps - dependency-name: wavesurfer.js dependency-version: 7.12.11 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-deps - dependency-name: "@aws-sdk/client-s3" dependency-version: 3.1090.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-deps - dependency-name: "@aws-sdk/lib-storage" dependency-version: 3.1090.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-deps ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]andGitHub
|
73e48c24d1 | chore(deps): bump the production-deps group with 17 updates (#509) | ||
|
dependabot[bot]andGitHub
|
ec72ff100d | chore(deps-dev): bump the dev-deps group with 10 updates (#510) | ||
|
semantic-release-bot
|
c6baf6018d |
chore(release): 2.1.0 [skip ci]
# [2.1.0](https://github.com/snapotter-hq/snapotter/compare/v2.0.0...v2.1.0) (2026-07-10) ### Bug Fixes * **demo:** boot to dashboard, sample-data notice, robust mobile editor icon ([#464](https://github.com/snapotter-hq/snapotter/issues/464)) ([ |
||
|
SnapOtter
|
d019217969 | chore(deps): bump the production-deps group | ||
|
SnapOtterandGitHub
|
dadf766899 |
fix(migrator): correct and harden the 1.x to 2.0 SQLite import (#434)
* feat(api): parse DATA_DIR from env for 1.x import auto-detection Claude-Session: https://claude.ai/code/session_01721WHAUGxnVk22qEeTub7w * test(migrator): build 1.17.2 fixtures by replaying legacy migrations Discovered the legacy migrations seed a Default team (0005) and builtin roles (0007), so the replayed fixture carries them. Seed uses a distinct custom team. Claude-Session: https://claude.ai/code/session_01721WHAUGxnVk22qEeTub7w * fix(migrator): self-adjusting column copy, jobs.status map, drop sessions, advisory lock The importer now inserts only the intersection of source and live target columns, so the three analytics_* columns 2.x dropped no longer break the first users INSERT (and future dropped columns are handled generically). jobs.status is mapped onto the 2.x enum (error->failed). Sessions are no longer migrated. A pg_advisory_xact_lock serializes concurrent replicas. Includes login-after-migrate and library assertions. Claude-Session: https://claude.ai/code/session_01721WHAUGxnVk22qEeTub7w * test(migrator): CI drift guard fails when a required column is unfillable from 1.17.2 Introspects every NOT-NULL-no-default column of each migrated table in the current schema and asserts the engine can fill it from a real 1.17.2 source. Turns a future breaking schema change into a PR-time failure instead of a production import break. Claude-Session: https://claude.ai/code/session_01721WHAUGxnVk22qEeTub7w * feat(migrator): orchestrator with detection, boot states, marker, blob count sqlite-import.ts owns source resolution (explicit path, 'off' sentinel, DATA_DIR probe), the four boot states (import/leftover/locked/none), the persisted sqlite_import marker, and a read-only library-blob count. runBootImport wires them together and catches TargetNonEmptyError as a benign multi-replica skip. Claude-Session: https://claude.ai/code/session_01721WHAUGxnVk22qEeTub7w * feat(api): route boot through the 1.x import orchestrator; hide marker from non-admins index.ts now calls runBootImport (which owns detection + the four boot states) instead of the inline SQLITE_MIGRATE_PATH block. The sqlite_import marker is added to SENSITIVE_KEYS (but not REDACTED_KEYS) so admins see the counts for the banner while non-admins don't see the key at all. Claude-Session: https://claude.ai/code/session_01721WHAUGxnVk22qEeTub7w * feat(migrator): add analyzeSqlite + dry-run/verify CLI analyzeSqlite is a read-only pre-flight (no live Postgres): per-table row counts, library-blob presence, and out-of-enum job statuses. The migrate:sqlite CLI now lives in the orchestrator and supports --dry-run/--verify (prints the analysis and exits without writing) alongside the existing import and --force. Claude-Session: https://claude.ai/code/session_01721WHAUGxnVk22qEeTub7w * docs: add 1.x to 2.0 upgrade guide; fix volume-name casing New apps/docs upgrade guide covering auto-detect, the SQLITE_MIGRATE_PATH override + off opt-out, the dry-run, what carries over, locked-state recovery, and non-destructive rollback. Leads with 'back up the WHOLE /data volume, not just snapotter.db' because 1.x WAL mode leaves data in snapotter.db-wal (surfaced by the real-image upgrade test). Standardizes README/DOCKERHUB compose volume names on the canonical SnapOtter-data casing so they match the repo compose and don't orphan an upgrader's volume. Claude-Session: https://claude.ai/code/session_01721WHAUGxnVk22qEeTub7w * feat(web): admin 1.x migration banner + 21-locale strings A one-time admin banner reads the sqlite_import marker from /v1/settings and shows the import result (user + saved-file counts) on success, or a warning when a 1.x database was found but not imported. Dismissal persists to a sqlite_import.dismissedAt settings key. shouldShowMigrationBanner/parseMigrationMarker sit in feedback.ts with the other shouldShow helpers; strings added to en.ts and all 20 other locales. Claude-Session: https://claude.ai/code/session_01721WHAUGxnVk22qEeTub7w * style(landing): biome-format Hero.astro trustBadges array Pre-existing formatting drift on main (its Lint check was skipped on the merge that introduced it); this PR's full Lint run surfaced it. Formatting-only, applied via the repo's own biome formatter to unblock the required Lint check. Claude-Session: https://claude.ai/code/session_01721WHAUGxnVk22qEeTub7w |
||
|
SnapOtterandGitHub
|
bf417a509e |
fix: first-run QA sweep of the single-container image (#413)
Fixes found by manually testing a fresh install end to end: - auth: the must-change-password gate returned 403 on public routes including /api/v1/health, so every fresh install showed a false "Reconnecting to server" banner on the forced password change screen. Public routes are now exempt (they need no session at all). Adds the gate's first direct tests. - multipart: @fastify/multipart's parts() iterator (9.4.0 and 10.0.0) ends on the request stream's "close", which on a reused keep-alive connection fires while an earlier part is still streaming to storage, silently dropping the parts behind it. The object eraser lost its mask file on every second POST per connection. Replaced with a busboy-driven iterator (lib/multipart-parts.ts) that ends on busboy's own "finish", installed for all routes via a preValidation hook; the tool-factory field-recovery workaround for the same bug is now unnecessary and removed. - eraser: the mask canvas backing store is natural resolution, but "absolute inset-0" does not stretch replaced elements, so the canvas rendered at intrinsic size and the brush ring, strokes, and exported mask were all misscaled on photos larger than the viewport. The canvas now gets an explicit CSS box at the fitted size. - compare slider: solid white divider with a dark halo so it stays visible over light images; still initialised at the painted region. - tool page: the AI bundle install prompt now centers in the content area instead of hugging the top. - api docs: disabled Scalar's cloud features (Ask AI, Generate MCP, Open API Client, dev toolbar), hid the "Powered by Scalar" footer link, and set the page title to "SnapOtter API Reference". The docs CSP blocks those cloud calls by design, so the buttons were dead UI. - docker: embedded Redis comes from packages.redis.io pinned to the 8.x major (was Debian's 7.0.15), matching the Compose stack and the documented claim. Build fails fast if the major ever drifts. - docs: DOCKERHUB.md quick start now leads with the one-command docker run (matching the README) with Compose as the production path; README says embedded Postgres 17 + Redis 8. Claude-Session: https://claude.ai/code/session_01XGB4pGvTvb7sUX4JN745U7 |
||
|
dependabot[bot]andGitHub
|
af7cd77e84 |
chore(deps): bump the production-deps group with 16 updates
Bumps the production-deps group with 16 updates: | Package | From | To | | --- | --- | --- | | [@scalar/fastify-api-reference](https://github.com/scalar/scalar/tree/HEAD/integrations/fastify) | `1.60.0` | `1.62.0` | | [@sentry/node](https://github.com/getsentry/sentry-javascript) | `10.59.0` | `10.62.0` | | [bullmq](https://github.com/taskforcesh/bullmq) | `5.79.1` | `5.79.2` | | [fastify](https://github.com/fastify/fastify) | `5.8.5` | `5.9.0` | | [js-yaml](https://github.com/nodeca/js-yaml) | `4.2.0` | `4.3.0` | | [playwright](https://github.com/microsoft/playwright) | `1.61.0` | `1.61.1` | | [posthog-node](https://github.com/PostHog/posthog-js/tree/HEAD/packages/node) | `5.38.2` | `5.38.6` | | [sharp](https://github.com/lovell/sharp) | `0.35.1` | `0.35.2` | | [tar](https://github.com/isaacs/node-tar) | `7.5.16` | `7.5.19` | | [lucide](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide) | `1.21.0` | `1.22.0` | | [@sentry/react](https://github.com/getsentry/sentry-javascript) | `10.59.0` | `10.62.0` | | [pdfjs-dist](https://github.com/mozilla/pdf.js) | `6.0.227` | `6.1.200` | | [posthog-js](https://github.com/PostHog/posthog-js) | `1.391.9` | `1.395.0` | | [react-hotkeys-hook](https://github.com/JohannesKlauss/react-keymap-hook) | `5.3.2` | `5.3.3` | | [@aws-sdk/client-s3](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3) | `3.1073.0` | `3.1075.0` | | [@aws-sdk/lib-storage](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/lib/lib-storage) | `3.1073.0` | `3.1075.0` | Updates `@scalar/fastify-api-reference` from 1.60.0 to 1.62.0 - [Release notes](https://github.com/scalar/scalar/releases) - [Changelog](https://github.com/scalar/scalar/blob/main/integrations/fastify/CHANGELOG.md) - [Commits](https://github.com/scalar/scalar/commits/HEAD/integrations/fastify) Updates `@sentry/node` from 10.59.0 to 10.62.0 - [Release notes](https://github.com/getsentry/sentry-javascript/releases) - [Changelog](https://github.com/getsentry/sentry-javascript/blob/develop/CHANGELOG.md) - [Commits](https://github.com/getsentry/sentry-javascript/compare/10.59.0...10.62.0) Updates `bullmq` from 5.79.1 to 5.79.2 - [Release notes](https://github.com/taskforcesh/bullmq/releases) - [Commits](https://github.com/taskforcesh/bullmq/compare/v5.79.1...v5.79.2) Updates `fastify` from 5.8.5 to 5.9.0 - [Release notes](https://github.com/fastify/fastify/releases) - [Commits](https://github.com/fastify/fastify/compare/v5.8.5...v5.9.0) Updates `js-yaml` from 4.2.0 to 4.3.0 - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.0/CHANGELOG.md) - [Commits](https://github.com/nodeca/js-yaml/compare/4.2.0...4.3.0) Updates `playwright` from 1.61.0 to 1.61.1 - [Release notes](https://github.com/microsoft/playwright/releases) - [Commits](https://github.com/microsoft/playwright/compare/v1.61.0...v1.61.1) Updates `posthog-node` from 5.38.2 to 5.38.6 - [Release notes](https://github.com/PostHog/posthog-js/releases) - [Changelog](https://github.com/PostHog/posthog-js/blob/main/packages/node/CHANGELOG.md) - [Commits](https://github.com/PostHog/posthog-js/commits/posthog-node@5.38.6/packages/node) Updates `sharp` from 0.35.1 to 0.35.2 - [Release notes](https://github.com/lovell/sharp/releases) - [Commits](https://github.com/lovell/sharp/compare/v0.35.1...v0.35.2) Updates `tar` from 7.5.16 to 7.5.19 - [Release notes](https://github.com/isaacs/node-tar/releases) - [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md) - [Commits](https://github.com/isaacs/node-tar/compare/v7.5.16...v7.5.19) Updates `lucide` from 1.21.0 to 1.22.0 - [Release notes](https://github.com/lucide-icons/lucide/releases) - [Commits](https://github.com/lucide-icons/lucide/commits/1.22.0/packages/lucide) Updates `@sentry/react` from 10.59.0 to 10.62.0 - [Release notes](https://github.com/getsentry/sentry-javascript/releases) - [Changelog](https://github.com/getsentry/sentry-javascript/blob/develop/CHANGELOG.md) - [Commits](https://github.com/getsentry/sentry-javascript/compare/10.59.0...10.62.0) Updates `pdfjs-dist` from 6.0.227 to 6.1.200 - [Release notes](https://github.com/mozilla/pdf.js/releases) - [Commits](https://github.com/mozilla/pdf.js/compare/v6.0.227...v6.1.200) Updates `posthog-js` from 1.391.9 to 1.395.0 - [Release notes](https://github.com/PostHog/posthog-js/releases) - [Changelog](https://github.com/PostHog/posthog-js/blob/main/CHANGELOG.md) - [Commits](https://github.com/PostHog/posthog-js/compare/posthog-js@1.391.9...posthog-js@1.395.0) Updates `react-hotkeys-hook` from 5.3.2 to 5.3.3 - [Release notes](https://github.com/JohannesKlauss/react-keymap-hook/releases) - [Changelog](https://github.com/JohannesKlauss/react-hotkeys-hook/blob/main/CHANGELOG.md) - [Commits](https://github.com/JohannesKlauss/react-keymap-hook/compare/v.5.3.2...v5.3.3) Updates `@aws-sdk/client-s3` from 3.1073.0 to 3.1075.0 - [Release notes](https://github.com/aws/aws-sdk-js-v3/releases) - [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-s3/CHANGELOG.md) - [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1075.0/clients/client-s3) Updates `@aws-sdk/lib-storage` from 3.1073.0 to 3.1075.0 - [Release notes](https://github.com/aws/aws-sdk-js-v3/releases) - [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/lib/lib-storage/CHANGELOG.md) - [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1075.0/lib/lib-storage) --- updated-dependencies: - dependency-name: "@scalar/fastify-api-reference" dependency-version: 1.62.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-deps - dependency-name: "@sentry/node" dependency-version: 10.62.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-deps - dependency-name: bullmq dependency-version: 5.79.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-deps - dependency-name: fastify dependency-version: 5.9.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-deps - dependency-name: js-yaml dependency-version: 4.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-deps - dependency-name: playwright dependency-version: 1.61.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-deps - dependency-name: posthog-node dependency-version: 5.38.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-deps - dependency-name: sharp dependency-version: 0.35.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-deps - dependency-name: tar dependency-version: 7.5.19 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-deps - dependency-name: lucide dependency-version: 1.22.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-deps - dependency-name: "@sentry/react" dependency-version: 10.62.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-deps - dependency-name: pdfjs-dist dependency-version: 6.1.200 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-deps - dependency-name: posthog-js dependency-version: 1.395.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-deps - dependency-name: react-hotkeys-hook dependency-version: 5.3.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-deps - dependency-name: "@aws-sdk/client-s3" dependency-version: 3.1075.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-deps - dependency-name: "@aws-sdk/lib-storage" dependency-version: 3.1075.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-deps ... Signed-off-by: dependabot[bot] <support@github.com> |
||
|
SnapOtterandGitHub
|
5d36ac06d8 |
feat(analytics): build-time bake + telemetry depth (#336)
Bake PostHog + Sentry into the published Docker image (SNAPOTTER_ANALYTICS build arg, codegen script). Delete entire consent system. Move event emission to BullMQ worker. Add cross-tier identity stitching, Sentry performance tracing on both tiers, frontend funnel events. Fix stateful regex bug. 86 files changed, 1593 insertions(+), 3747 deletions(-) |
||
|
|
717de2577a |
chore(deps): bump the production-deps group across 1 directory with 18 updates (#326)
Bumps the production-deps group with 18 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@scalar/fastify-api-reference](https://github.com/scalar/scalar/tree/HEAD/integrations/fastify) | `1.59.3` | `1.60.0` | | [@sentry/node](https://github.com/getsentry/sentry-javascript) | `10.57.0` | `10.59.0` | | [bullmq](https://github.com/taskforcesh/bullmq) | `5.78.1` | `5.79.1` | | [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) | `5.9.0` | `5.9.3` | | [ipaddr.js](https://github.com/whitequark/ipaddr.js) | `2.3.0` | `2.4.0` | | [papaparse](https://github.com/mholt/PapaParse) | `5.5.3` | `5.5.4` | | [pg](https://github.com/brianc/node-postgres/tree/HEAD/packages/pg) | `8.21.0` | `8.22.0` | | [playwright](https://github.com/microsoft/playwright) | `1.60.0` | `1.61.0` | | [posthog-node](https://github.com/PostHog/posthog-js/tree/HEAD/packages/node) | `5.37.0` | `5.38.2` | | [sharp](https://github.com/lovell/sharp) | `0.35.1` | `0.35.2` | | [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) | `6.4.7` | `6.4.8` | | [lucide](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide) | `1.18.0` | `1.21.0` | | [@sentry/react](https://github.com/getsentry/sentry-javascript) | `10.57.0` | `10.59.0` | | [posthog-js](https://github.com/PostHog/posthog-js) | `1.386.6` | `1.391.9` | | [react-image-crop](https://github.com/dominictobias/react-image-crop) | `11.0.10` | `11.1.2` | | [react-router-dom](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom) | `7.17.0` | `7.18.0` | | [@aws-sdk/client-s3](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3) | `3.1068.0` | `3.1073.0` | | [@aws-sdk/lib-storage](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/lib/lib-storage) | `3.1068.0` | `3.1073.0` | Updates `@scalar/fastify-api-reference` from 1.59.3 to 1.60.0 - [Release notes](https://github.com/scalar/scalar/releases) - [Changelog](https://github.com/scalar/scalar/blob/main/integrations/fastify/CHANGELOG.md) - [Commits](https://github.com/scalar/scalar/commits/HEAD/integrations/fastify) Updates `@sentry/node` from 10.57.0 to 10.59.0 - [Release notes](https://github.com/getsentry/sentry-javascript/releases) - [Changelog](https://github.com/getsentry/sentry-javascript/blob/develop/CHANGELOG.md) - [Commits](https://github.com/getsentry/sentry-javascript/compare/10.57.0...10.59.0) Updates `bullmq` from 5.78.1 to 5.79.1 - [Release notes](https://github.com/taskforcesh/bullmq/releases) - [Commits](https://github.com/taskforcesh/bullmq/compare/v5.78.1...v5.79.1) Updates `fast-xml-parser` from 5.9.0 to 5.9.3 - [Release notes](https://github.com/NaturalIntelligence/fast-xml-parser/releases) - [Changelog](https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/CHANGELOG.md) - [Commits](https://github.com/NaturalIntelligence/fast-xml-parser/compare/v5.9.0...v5.9.3) Updates `ipaddr.js` from 2.3.0 to 2.4.0 - [Changelog](https://github.com/whitequark/ipaddr.js/blob/main/Changes.md) - [Commits](https://github.com/whitequark/ipaddr.js/compare/v2.3.0...v2.4.0) Updates `papaparse` from 5.5.3 to 5.5.4 - [Release notes](https://github.com/mholt/PapaParse/releases) - [Changelog](https://github.com/mholt/PapaParse/blob/master/CHANGELOG.md) - [Commits](https://github.com/mholt/PapaParse/compare/5.5.3...5.5.4) Updates `pg` from 8.21.0 to 8.22.0 - [Changelog](https://github.com/brianc/node-postgres/blob/master/CHANGELOG.md) - [Commits](https://github.com/brianc/node-postgres/commits/pg@8.22.0/packages/pg) Updates `playwright` from 1.60.0 to 1.61.0 - [Release notes](https://github.com/microsoft/playwright/releases) - [Commits](https://github.com/microsoft/playwright/compare/v1.60.0...v1.61.0) Updates `posthog-node` from 5.37.0 to 5.38.2 - [Release notes](https://github.com/PostHog/posthog-js/releases) - [Changelog](https://github.com/PostHog/posthog-js/blob/main/packages/node/CHANGELOG.md) - [Commits](https://github.com/PostHog/posthog-js/commits/posthog-node@5.38.2/packages/node) Updates `sharp` from 0.35.1 to 0.35.2 - [Release notes](https://github.com/lovell/sharp/releases) - [Commits](https://github.com/lovell/sharp/compare/v0.35.1...v0.35.2) Updates `astro` from 6.4.7 to 6.4.8 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/astro@6.4.8/packages/astro/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/astro@6.4.8/packages/astro) Updates `lucide` from 1.18.0 to 1.21.0 - [Release notes](https://github.com/lucide-icons/lucide/releases) - [Commits](https://github.com/lucide-icons/lucide/commits/1.21.0/packages/lucide) Updates `@sentry/react` from 10.57.0 to 10.59.0 - [Release notes](https://github.com/getsentry/sentry-javascript/releases) - [Changelog](https://github.com/getsentry/sentry-javascript/blob/develop/CHANGELOG.md) - [Commits](https://github.com/getsentry/sentry-javascript/compare/10.57.0...10.59.0) Updates `posthog-js` from 1.386.6 to 1.391.9 - [Release notes](https://github.com/PostHog/posthog-js/releases) - [Changelog](https://github.com/PostHog/posthog-js/blob/main/CHANGELOG.md) - [Commits](https://github.com/PostHog/posthog-js/compare/posthog-js@1.386.6...posthog-js@1.391.9) Updates `react-image-crop` from 11.0.10 to 11.1.2 - [Release notes](https://github.com/dominictobias/react-image-crop/releases) - [Commits](https://github.com/dominictobias/react-image-crop/compare/11.0.10...11.1.2) Updates `react-router-dom` from 7.17.0 to 7.18.0 - [Release notes](https://github.com/remix-run/react-router/releases) - [Changelog](https://github.com/remix-run/react-router/blob/react-router-dom@7.18.0/packages/react-router-dom/CHANGELOG.md) - [Commits](https://github.com/remix-run/react-router/commits/react-router-dom@7.18.0/packages/react-router-dom) Updates `@aws-sdk/client-s3` from 3.1068.0 to 3.1073.0 - [Release notes](https://github.com/aws/aws-sdk-js-v3/releases) - [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-s3/CHANGELOG.md) - [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1073.0/clients/client-s3) Updates `@aws-sdk/lib-storage` from 3.1068.0 to 3.1073.0 - [Release notes](https://github.com/aws/aws-sdk-js-v3/releases) - [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/lib/lib-storage/CHANGELOG.md) - [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1073.0/lib/lib-storage) --- updated-dependencies: - dependency-name: "@aws-sdk/client-s3" dependency-version: 3.1073.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-deps - dependency-name: "@aws-sdk/lib-storage" dependency-version: 3.1073.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-deps - dependency-name: "@scalar/fastify-api-reference" dependency-version: 1.60.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-deps - dependency-name: "@sentry/node" dependency-version: 10.59.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-deps - dependency-name: "@sentry/react" dependency-version: 10.59.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-deps - dependency-name: astro dependency-version: 6.4.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-deps - dependency-name: bullmq dependency-version: 5.79.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-deps - dependency-name: fast-xml-parser dependency-version: 5.9.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-deps - dependency-name: ipaddr.js dependency-version: 2.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-deps - dependency-name: lucide dependency-version: 1.21.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-deps - dependency-name: papaparse dependency-version: 5.5.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-deps - dependency-name: pg dependency-version: 8.22.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-deps - dependency-name: playwright dependency-version: 1.61.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-deps - dependency-name: posthog-js dependency-version: 1.391.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-deps - dependency-name: posthog-node dependency-version: 5.38.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-deps - dependency-name: react-image-crop dependency-version: 11.1.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-deps - dependency-name: react-router-dom dependency-version: 7.18.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-deps - dependency-name: sharp dependency-version: 0.35.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-deps ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
|
c8371c3cd1 |
chore(deps-dev): bump the dev-deps group with 5 updates (#297)
Bumps the dev-deps group with 5 updates: | Package | From | To | | --- | --- | --- | | [@playwright/test](https://github.com/microsoft/playwright) | `1.60.0` | `1.61.0` | | [@testcontainers/postgresql](https://github.com/testcontainers/testcontainers-node) | `12.0.2` | `12.0.3` | | [@testcontainers/redis](https://github.com/testcontainers/testcontainers-node) | `12.0.2` | `12.0.3` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `22.19.21` | `22.20.0` | | [vitepress-plugin-llms](https://github.com/okineadev/vitepress-plugin-llms) | `1.13.1` | `1.13.2` | Updates `@playwright/test` from 1.60.0 to 1.61.0 - [Release notes](https://github.com/microsoft/playwright/releases) - [Commits](https://github.com/microsoft/playwright/compare/v1.60.0...v1.61.0) Updates `@testcontainers/postgresql` from 12.0.2 to 12.0.3 - [Release notes](https://github.com/testcontainers/testcontainers-node/releases) - [Commits](https://github.com/testcontainers/testcontainers-node/compare/v12.0.2...v12.0.3) Updates `@testcontainers/redis` from 12.0.2 to 12.0.3 - [Release notes](https://github.com/testcontainers/testcontainers-node/releases) - [Commits](https://github.com/testcontainers/testcontainers-node/compare/v12.0.2...v12.0.3) Updates `@types/node` from 22.19.21 to 22.20.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `vitepress-plugin-llms` from 1.13.1 to 1.13.2 - [Release notes](https://github.com/okineadev/vitepress-plugin-llms/releases) - [Commits](https://github.com/okineadev/vitepress-plugin-llms/compare/v1.13.1...v1.13.2) --- updated-dependencies: - dependency-name: "@playwright/test" dependency-version: 1.61.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-deps - dependency-name: "@testcontainers/postgresql" dependency-version: 12.0.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-deps - dependency-name: "@testcontainers/redis" dependency-version: 12.0.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-deps - dependency-name: "@types/node" dependency-version: 22.20.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-deps - dependency-name: vitepress-plugin-llms dependency-version: 1.13.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-deps ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
SnapOtterandGitHub
|
f75cc328ac |
fix(security): numeric CIDR matching for IPv6 SSRF allow/deny
Replace textual prefix matching in isPrivateIPv6() with numeric bit-prefix matching via ipaddr.js. Closes reachable classifier bypasses for IPv4-compatible IPv6 (::a.b.c.d), site-local fec0::/10, and the full fe80::/10 link-local span, on top of the IPv4-mapped forms. Embedded IPv4 (mapped and compatible) is run through the full isPrivateIPv4 classifier; unparseable input fails closed.
Follow-up hardening to
|
||
|
SnapOtter
|
620552569e |
feat!: SnapOtter 2.0.0
Bump all workspace package versions and APP_VERSION to 2.0.0, marking the official 2.0 release. Removes the stale 1.x .release-notes.md artifact (semantic-release regenerates release notes). The 2.0/multimodality docs and rebrand already landed on main via #254 and #261, so this carries only the version designation forward from the rebrand branch. BREAKING CHANGE: SnapOtter 2.0 - the platform re-architecture (Postgres 17 + Redis 8 + BullMQ durable jobs, 157 tools across five modalities) is the 2.0 release line, replacing the 1.x SQLite single-container architecture. |
||
|
SnapOtter
|
9a61cb6af1 |
chore(deps-dev): bump the dev-deps group with 10 updates (#238)
Bumps @biomejs/biome, @testcontainers/postgresql, @testcontainers/redis, @tailwindcss/vite, @types/node, @types/react, @types/yauzl, tailwindcss, semantic-release, turbo. |
||
|
|
784f7a28cd |
chore(deps): bump the production-deps group with 15 updates (#237)
Bumps the production-deps group with 15 updates: | Package | From | To | | --- | --- | --- | | [@scalar/fastify-api-reference](https://github.com/scalar/scalar/tree/HEAD/integrations/fastify) | `1.58.0` | `1.59.3` | | [@sentry/node](https://github.com/getsentry/sentry-javascript) | `10.56.0` | `10.57.0` | | [bullmq](https://github.com/taskforcesh/bullmq) | `5.78.0` | `5.78.1` | | [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) | `5.8.0` | `5.9.0` | | [ioredis](https://github.com/luin/ioredis) | `5.10.1` | `5.11.1` | | [pdfkit](https://github.com/foliojs/pdfkit) | `0.18.0` | `0.19.1` | | [posthog-node](https://github.com/PostHog/posthog-js/tree/HEAD/packages/node) | `5.35.14` | `5.37.0` | | [sharp](https://github.com/lovell/sharp) | `0.34.5` | `0.35.1` | | [@sentry/react](https://github.com/getsentry/sentry-javascript) | `10.56.0` | `10.57.0` | | [posthog-js](https://github.com/PostHog/posthog-js) | `1.379.2` | `1.386.6` | | [react-colorful](https://github.com/omgovich/react-colorful) | `5.6.1` | `5.7.0` | | [react-konva](https://github.com/konvajs/react-konva) | `19.2.3` | `19.2.5` | | [react-router-dom](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom) | `7.16.0` | `7.17.0` | | [@aws-sdk/client-s3](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3) | `3.1066.0` | `3.1068.0` | | [@aws-sdk/lib-storage](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/lib/lib-storage) | `3.1066.0` | `3.1068.0` | Updates `@scalar/fastify-api-reference` from 1.58.0 to 1.59.3 - [Release notes](https://github.com/scalar/scalar/releases) - [Changelog](https://github.com/scalar/scalar/blob/main/integrations/fastify/CHANGELOG.md) - [Commits](https://github.com/scalar/scalar/commits/HEAD/integrations/fastify) Updates `@sentry/node` from 10.56.0 to 10.57.0 - [Release notes](https://github.com/getsentry/sentry-javascript/releases) - [Changelog](https://github.com/getsentry/sentry-javascript/blob/develop/CHANGELOG.md) - [Commits](https://github.com/getsentry/sentry-javascript/compare/10.56.0...10.57.0) Updates `bullmq` from 5.78.0 to 5.78.1 - [Release notes](https://github.com/taskforcesh/bullmq/releases) - [Commits](https://github.com/taskforcesh/bullmq/compare/v5.78.0...v5.78.1) Updates `fast-xml-parser` from 5.8.0 to 5.9.0 - [Release notes](https://github.com/NaturalIntelligence/fast-xml-parser/releases) - [Changelog](https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/CHANGELOG.md) - [Commits](https://github.com/NaturalIntelligence/fast-xml-parser/compare/v5.8.0...v5.9.0) Updates `ioredis` from 5.10.1 to 5.11.1 - [Release notes](https://github.com/luin/ioredis/releases) - [Changelog](https://github.com/redis/ioredis/blob/main/CHANGELOG.md) - [Commits](https://github.com/luin/ioredis/compare/v5.10.1...v5.11.1) Updates `pdfkit` from 0.18.0 to 0.19.1 - [Release notes](https://github.com/foliojs/pdfkit/releases) - [Changelog](https://github.com/foliojs/pdfkit/blob/master/CHANGELOG.md) - [Commits](https://github.com/foliojs/pdfkit/compare/v0.18.0...v0.19.1) Updates `posthog-node` from 5.35.14 to 5.37.0 - [Release notes](https://github.com/PostHog/posthog-js/releases) - [Changelog](https://github.com/PostHog/posthog-js/blob/main/packages/node/CHANGELOG.md) - [Commits](https://github.com/PostHog/posthog-js/commits/posthog-node@5.37.0/packages/node) Updates `sharp` from 0.34.5 to 0.35.1 - [Release notes](https://github.com/lovell/sharp/releases) - [Commits](https://github.com/lovell/sharp/compare/v0.34.5...v0.35.1) Updates `@sentry/react` from 10.56.0 to 10.57.0 - [Release notes](https://github.com/getsentry/sentry-javascript/releases) - [Changelog](https://github.com/getsentry/sentry-javascript/blob/develop/CHANGELOG.md) - [Commits](https://github.com/getsentry/sentry-javascript/compare/10.56.0...10.57.0) Updates `posthog-js` from 1.379.2 to 1.386.6 - [Release notes](https://github.com/PostHog/posthog-js/releases) - [Changelog](https://github.com/PostHog/posthog-js/blob/main/CHANGELOG.md) - [Commits](https://github.com/PostHog/posthog-js/compare/posthog-js@1.379.2...posthog-js@1.386.6) Updates `react-colorful` from 5.6.1 to 5.7.0 - [Release notes](https://github.com/omgovich/react-colorful/releases) - [Changelog](https://github.com/omgovich/react-colorful/blob/master/CHANGELOG.md) - [Commits](https://github.com/omgovich/react-colorful/commits/5.7.0) Updates `react-konva` from 19.2.3 to 19.2.5 - [Release notes](https://github.com/konvajs/react-konva/releases) - [Commits](https://github.com/konvajs/react-konva/commits) Updates `react-router-dom` from 7.16.0 to 7.17.0 - [Release notes](https://github.com/remix-run/react-router/releases) - [Changelog](https://github.com/remix-run/react-router/blob/main/packages/react-router-dom/CHANGELOG.md) - [Commits](https://github.com/remix-run/react-router/commits/react-router-dom@7.17.0/packages/react-router-dom) Updates `@aws-sdk/client-s3` from 3.1066.0 to 3.1068.0 - [Release notes](https://github.com/aws/aws-sdk-js-v3/releases) - [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-s3/CHANGELOG.md) - [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1068.0/clients/client-s3) Updates `@aws-sdk/lib-storage` from 3.1066.0 to 3.1068.0 - [Release notes](https://github.com/aws/aws-sdk-js-v3/releases) - [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/lib/lib-storage/CHANGELOG.md) - [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1068.0/lib/lib-storage) --- updated-dependencies: - dependency-name: "@scalar/fastify-api-reference" dependency-version: 1.59.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-deps - dependency-name: "@sentry/node" dependency-version: 10.57.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-deps - dependency-name: bullmq dependency-version: 5.78.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-deps - dependency-name: fast-xml-parser dependency-version: 5.9.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-deps - dependency-name: ioredis dependency-version: 5.11.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-deps - dependency-name: pdfkit dependency-version: 0.19.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-deps - dependency-name: posthog-node dependency-version: 5.37.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-deps - dependency-name: sharp dependency-version: 0.35.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-deps - dependency-name: "@sentry/react" dependency-version: 10.57.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-deps - dependency-name: posthog-js dependency-version: 1.386.6 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-deps - dependency-name: react-colorful dependency-version: 5.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-deps - dependency-name: react-konva dependency-version: 19.2.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-deps - dependency-name: react-router-dom dependency-version: 7.17.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-deps - dependency-name: "@aws-sdk/client-s3" dependency-version: 3.1068.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-deps - dependency-name: "@aws-sdk/lib-storage" dependency-version: 3.1068.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-deps ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
SnapOtterandGitHub
|
3fb8164fa5 |
feat: add OpenTelemetry distributed tracing (enterprise) (#232)
* feat(tracing): add OpenTelemetry dependencies and --import preload flag * feat(enterprise): add distributed_tracing feature gate * feat(tracing): add SDK bootstrap with enterprise gating * fix(tracing): correct test coverage for enterprise-unavailable path and prevent double-init Test 2 now mocks @snapotter/enterprise to throw an import error, exercising the catch block in the preload. Test 3 imports with no endpoint so the preload is a no-op, avoiding leaked SDK from double-initialization. Added idempotency guard to initTracing() as a safety net. * feat(tracing): add Pino trace mixin and shared logger When OTel tracing is active, every Pino log line now includes traceId, spanId, and traceFlags fields for log-to-trace correlation. The mixin is a no-op when no SDK is registered (community users). * feat(tracing): add _otel to ToolJobData and inject trace context at enqueue Add optional _otel carrier field to ToolJobData for W3C trace context propagation across BullMQ job boundaries. When an active OTel span exists, propagation.inject() writes traceparent/tracestate into the job data before queue.add(). When no SDK is registered (community edition), the carrier stays empty and _otel remains undefined -- zero overhead. * feat(tracing): extract trace context and create spans in BullMQ worker * feat(tracing): inject trace context into Python sidecar calls * feat(tracing): add trace context extraction to Python sidecar * feat(tracing): add shutdownTracing to graceful shutdown sequence * feat(tracing): enrich HTTP spans with tool_id and user_id attributes * docs: add OpenTelemetry env var documentation to .env.example * test(tracing): add lifecycle integration tests for trace propagation * fix(tracing): inject trace context into pipeline and batch flow jobs * fix(tracing): add sidecar.execute Node-side span and remove unnecessary comment Wraps PythonDispatcher.run() with a sidecar.execute span on the Node side so traces show the full round-trip (Node span -> Python span). Also removes an obvious comment from logger.ts. |
||
|
SnapOtter
|
8eefa46981 | chore: install @node-saml/node-saml and otpauth for Phase 3 identity | ||
|
SnapOtter
|
6e1b9865f1 | feat(tools): 2.0 phase 5 wave 5a - image gap-fill (11 tools) (#225) | ||
|
SnapOtter
|
fc7c1f850e | feat(tools): 2.0 phase 5 wave 4 - office, ebooks, data, archives (14 tools) (#224) | ||
|
SnapOtter
|
ae1337901d | feat(tools)!: SnapOtter 2.0 phase 4 wave 1: 45 core tools across all modalities (#219) | ||
|
SnapOtter
|
d647d8ed19 | feat(modality)!: SnapOtter 2.0 phase 3 modality framework: media/doc engines, pool routing, display modes (#218) | ||
|
SnapOtter
|
c451b939c7 | feat(jobs)!: SnapOtter 2.0 phase 2 job spine: async queues, worker pools, object storage, admin dashboard (#217) | ||
|
SnapOtterandGitHub
|
1c724d5d21 |
feat(db)!: SnapOtter 2.0 phase 1 foundation: postgres, migrator, compose stack (#216)
* feat(infra): add dev compose stack with postgres and redis
* fix(infra): comment dev env defaults until wired; harden dev compose restart and start_period
* chore(deps): add pg driver and testcontainers for postgres migration
* feat(db): translate schema to drizzle pg-core (timestamptz, boolean, pgEnum, jsonb)
Schema translation (apps/api/src/db/schema.ts):
- sqlite-core -> pg-core, all 10 tables preserved 1:1
- integer(mode:'timestamp') -> timestamp({ withTimezone: true })
- integer(mode:'boolean') -> boolean
- jobs.status text enum -> pgEnum('job_status') with same 4 values
- 7 columns changed from text to jsonb: jobs.inputFiles, jobs.settings,
pipelines.steps, apiKeys.permissions, roles.permissions,
auditLog.details, userFiles.toolChain
- settings.value stays text, jobs.error stays text, jobs.progress stays real
jsonb call-site sweep (removed JSON.stringify on writes, JSON.parse on reads):
- apps/api/src/routes/roles.ts: permissions read/write (3 sites)
- apps/api/src/routes/api-keys.ts: permissions write + read (2 sites)
- apps/api/src/routes/audit-log.ts: details read (1 site)
- apps/api/src/routes/pipeline.ts: steps write + read (2 sites)
- apps/api/src/routes/progress.ts: inputFiles write (2 sites)
- apps/api/src/routes/tool-factory.ts: toolChain read + write (2 sites)
- apps/api/src/routes/user-files.ts: toolChain read + write (4 sites)
- apps/api/src/permissions.ts: roles.permissions read (1 site)
- apps/api/src/lib/audit.ts: details write (1 site)
- apps/api/src/plugins/auth.ts: apiKeys.permissions read (1 site)
* refactor(db): type jsonb columns via $type and note raw CTE conversion requirements
* feat(db): archive sqlite migrations and generate postgres baseline
* chore(db): dockerignore legacy migrations, add archive breadcrumb, fix trailing newline
* feat(db): pg pool connection, advisory-locked boot migrations, DATABASE_URL config
* fix(db): friendly fatal on unreachable postgres, idempotent closeDb, lock-key convention note
* refactor(db): async drizzle calls in plugins, lib, permissions
* fix(api): analytics never throws, typed permission guard, single-query session invalidation
* refactor(db): async drizzle calls across all routes and bootstrap
Convert every route file and index.ts from sync SQLite drizzle
patterns to async node-postgres drizzle:
- .all() removed (bare await on select)
- .get() converted to destructured [row] = await ...
- .run() removed (bare await on insert/update/delete)
- .changes replaced with .rowCount (null-guarded) in progress.ts
- sqlite import removed from user-files.ts; raw CTEs converted to
await db.execute(sql`...`) with postgres-dialect recursive CTEs
- ChainRow types updated: tool_chain is parsed jsonb (string[] | null),
created_at is Date (timestamptz) with no * 1000 conversion
- All requirePermission() guard calls awaited (security: unawaited
async guard returns truthy Promise, bypassing permission check)
- All hasEffectivePermission() and getPermissions() calls awaited
- All auditLog() calls awaited (preserves write-before-response order)
- trackEvent() and captureException() left un-awaited (fire-and-forget
by design, guaranteed never-throw)
- ensureAnonymousUser(), startCleanupCron(), recoverStaleJobs() awaited
in bootstrap sequence
- ensureInstanceId() and ensureDefaultSettings() made async
Files converted: 14 (index.ts + 12 route files + tools/index.ts)
* fix(db): await async checkStorageQuota in user-files upload/save routes
* fix(db): await checkStorageQuota in save-result route (missed second call site)
* feat(db): sqlite-to-postgres migrator with CLI and first-boot import
* fix(db): migrator error context, honest force semantics, boot-hook fatal, null-variance tests
* test: run suite against per-file postgres databases via testcontainers
- Add tests/global-setup.ts: spins up a Postgres testcontainer,
creates a migrated template database once per vitest run.
- Rewrite tests/setup/per-fork-env.ts: each test file (forks pool)
clones the template into its own database via CREATE DATABASE ...
TEMPLATE, preserving the same per-file isolation granularity.
- Update vitest.config.ts: add globalSetup, pg alias, update comment.
- Fix tests/integration/test-server.ts: remove DB_PATH mkdir, async
runMigrations, async db operations, remove SQLite WAL checkpoint.
- Fix 21 unit test db/index mocks: add pool and closeDb exports.
- Fix 8 unit test files: add async/await for now-async permission,
audit, and analytics functions.
- Fix 18 integration test files: convert sync .run()/.all()/.get()
to async drizzle patterns, add async to callbacks.
- Production change: apps/api/src/routes/teams.ts: cast COUNT(*)
to ::int so Postgres returns a number instead of bigint string.
* fix(db): seed built-in roles, reject NUL bytes, cast COUNT, serialize job persists
- Seed built-in roles (admin, editor, user) at boot via ensureBuiltinRoles()
with onConflictDoNothing, restoring data that legacy SQLite migration 0007
provided via INSERT statements (the pg baseline is DDL-only).
- Reject NUL bytes in login credentials with 401 (postgres rejects \x00 in
text columns; valid usernames never contain NUL, matching 1.x behavior).
- Cast COUNT(*)::int in user-files, audit-log, and roles listing queries so
postgres returns a JS number instead of bigint-as-string.
- Serialize fire-and-forget job progress DB writes per jobId so the final
"completed" status is never overwritten by a late-arriving "processing"
write (race condition exposed by async postgres round-trips).
* test: fix teams race, seed roles in test server, poll for job status
- Add missing await to resetTeams() in teams PUT beforeEach (the async
delete raced with the subsequent insert under postgres).
- Call ensureBuiltinRoles() in test server bootstrap so integration tests
have the same built-in roles as production.
- Replace fixed 100ms flushPersist delay with a polling helper that waits
for terminal job status, eliminating timing-dependent failures caused by
postgres network round-trip latency.
* test: make heic temp-file cleanup assertion resilient to concurrent workers
Use a set-based diff instead of raw file count when checking that
decodeHeic cleans up temp files. Other concurrent test workers can
create heic-in-*/heic-out-* files in the shared tmpdir, inflating the
"after" count and causing spurious failures under full-suite load.
* fix(db): align builtin-role seed to post-0010 legacy state; test polish
* feat(docker): three-container compose (app, postgres, redis) with boot wait and migrations
* fix(docker): set TEST_DATABASE_URL so containerized tests skip testcontainers
* chore(docker): test compose project name, clearer 1.x upgrade comment, unref probe timer
* feat(enterprise): enforce D15 license boundary; move s3 storage into packages/enterprise
* fix(enterprise): restore lazy aws-sdk loading; community installs load no s3 code at boot
* fix(enterprise): boundary check catches dynamic imports; document getS3 concurrency
* feat(db)!: SnapOtter 2.0 phase 1 foundation: postgres, migrator, compose stack
BREAKING CHANGE: SQLite is no longer the runtime database. Deployments now
require Postgres (and Redis, used from phase 2). Existing installs migrate
with SQLITE_MIGRATE_PATH or 'pnpm --filter @snapotter/api migrate:sqlite'.
* fix(ci): postgres service + fresh e2e database per run; ignore unfixable torch CVE-2025-3000
|
||
|
SnapOtter
|
8792080982 |
fix(deps): patch Dependabot security alerts
- Pillow 11.1.0 -> 12.2.0 (6 CVEs: OOB writes, decompression bomb, DoS) - rembg 2.0.62 -> 2.0.75 (SSRF + path traversal in server component) - @fastify/static ^8.1.0 -> ^9.1.3 (path traversal + route guard bypass) - Remove redundant @fastify/static pnpm override - Dismiss stale esbuild alert (already at 0.28.0) - Dismiss file-type alert (16.5.4 is dev-only via @types/potrace) |
||
|
SnapOtter
|
0e850ba5e0 |
feat: add playwright dependency for html-to-image tool
Install playwright in apps/api for the browser-based screenshot service that will power the HTML to Image tool. |
||
|
SnapOtter
|
3b84fab765 |
feat: add enterprise licensing and S3 storage backend
Add the enterprise package with Ed25519 license key validation and feature gating. Enterprise code lives in the public repo under a proprietary license (Cal.com/PostHog model), protected legally, not by code hiding. Implement S3-compatible storage backend as the first enterprise feature. The file-storage module now delegates to either local filesystem or S3 based on STORAGE_MODE env var. Works with AWS S3, Cloudflare R2, DigitalOcean Spaces, MinIO, and any S3-compatible provider. Workspace files remain local (ephemeral processing). New env vars: STORAGE_MODE, S3_BUCKET, S3_REGION, S3_ENDPOINT, S3_ACCESS_KEY_ID, S3_SECRET_ACCESS_KEY, S3_FORCE_PATH_STYLE, S3_PREFIX, SNAPOTTER_LICENSE_KEY. Tested against MinIO: 10 S3 integration tests + 82 existing tests pass with zero regressions. |
||
|
|
1616ad1a5a |
chore(deps-dev): bump dev-deps group + fix vitest 3.2.6 mock resolution (#197)
* chore(deps-dev): bump the dev-deps group across 1 directory with 7 updates Bumps the dev-deps group with 7 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `2.4.15` | `2.4.16` | | [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) | `3.2.4` | `3.2.6` | | [turbo](https://github.com/vercel/turborepo) | `2.9.14` | `2.9.16` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `3.2.4` | `3.2.6` | | [@types/opentype.js](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/opentype.js) | `1.3.9` | `1.3.10` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `6.4.2` | `6.4.3` | | [vitepress-plugin-llms](https://github.com/okineadev/vitepress-plugin-llms) | `1.12.2` | `1.13.1` | Updates `@biomejs/biome` from 2.4.15 to 2.4.16 - [Release notes](https://github.com/biomejs/biome/releases) - [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md) - [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.4.16/packages/@biomejs/biome) Updates `@vitest/coverage-v8` from 3.2.4 to 3.2.6 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v3.2.6/packages/coverage-v8) Updates `turbo` from 2.9.14 to 2.9.16 - [Release notes](https://github.com/vercel/turborepo/releases) - [Changelog](https://github.com/vercel/turborepo/blob/main/RELEASE.md) - [Commits](https://github.com/vercel/turborepo/compare/v2.9.14...v2.9.16) Updates `vitest` from 3.2.4 to 3.2.6 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v3.2.6/packages/vitest) Updates `@types/opentype.js` from 1.3.9 to 1.3.10 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/opentype.js) Updates `vite` from 6.4.2 to 6.4.3 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v6.4.3/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v6.4.3/packages/vite) Updates `vitepress-plugin-llms` from 1.12.2 to 1.13.1 - [Release notes](https://github.com/okineadev/vitepress-plugin-llms/releases) - [Commits](https://github.com/okineadev/vitepress-plugin-llms/compare/v1.12.2...v1.13.1) --- updated-dependencies: - dependency-name: "@biomejs/biome" dependency-version: 2.4.16 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-deps - dependency-name: "@vitest/coverage-v8" dependency-version: 3.2.6 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-deps - dependency-name: turbo dependency-version: 2.9.16 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-deps - dependency-name: vitest dependency-version: 3.2.6 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-deps - dependency-name: "@types/opentype.js" dependency-version: 1.3.10 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-deps - dependency-name: vite dependency-version: 6.4.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-deps - dependency-name: vitepress-plugin-llms dependency-version: 1.13.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-deps ... Signed-off-by: dependabot[bot] <support@github.com> * fix(test): resolve vitest 3.2.6 mock path breakage for posthog-node and @sentry/node Add posthog-node and @sentry/node to vitest resolve aliases (matching the existing pattern for all other api-workspace packages) and switch the analytics test mocks from fragile relative node_modules paths to bare specifiers. Vitest 3.2.6 changed how it matches mock paths through pnpm symlinks after vi.resetModules(), causing 9 analytics test failures. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
|
ed8cea7dc9 |
chore(deps): bump the production-deps group across 1 directory with 15 updates (#195)
Bumps the production-deps group with 15 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@neplex/vectorizer](https://github.com/neplextech/vectorizer) | `0.0.5` | `0.1.0` | | [@scalar/fastify-api-reference](https://github.com/scalar/scalar/tree/HEAD/integrations/fastify) | `1.57.2` | `1.57.5` | | [@sentry/node](https://github.com/getsentry/sentry-javascript) | `10.53.1` | `10.55.0` | | [js-yaml](https://github.com/nodeca/js-yaml) | `4.1.1` | `4.2.0` | | [posthog-node](https://github.com/PostHog/posthog-js/tree/HEAD/packages/node) | `5.34.3` | `5.35.9` | | [tsx](https://github.com/privatenumber/tsx) | `4.22.1` | `4.22.4` | | [zxing-wasm](https://github.com/Sec-ant/zxing-wasm) | `3.0.3` | `3.1.0` | | [react](https://github.com/facebook/react/tree/HEAD/packages/react) | `19.2.6` | `19.2.7` | | [react-dom](https://github.com/facebook/react/tree/HEAD/packages/react-dom) | `19.2.6` | `19.2.7` | | [@sentry/react](https://github.com/getsentry/sentry-javascript) | `10.53.1` | `10.55.0` | | [posthog-js](https://github.com/PostHog/posthog-js) | `1.374.0` | `1.377.0` | | [react-colorful](https://github.com/omgovich/react-colorful) | `5.6.1` | `5.7.0` | | [react-konva](https://github.com/konvajs/react-konva) | `19.2.3` | `19.2.4` | | [react-router-dom](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom) | `7.15.1` | `7.16.0` | | [zustand](https://github.com/pmndrs/zustand) | `5.0.13` | `5.0.14` | Updates `@neplex/vectorizer` from 0.0.5 to 0.1.0 - [Release notes](https://github.com/neplextech/vectorizer/releases) - [Commits](https://github.com/neplextech/vectorizer/compare/v0.0.5...v0.1.0) Updates `@scalar/fastify-api-reference` from 1.57.2 to 1.57.5 - [Release notes](https://github.com/scalar/scalar/releases) - [Changelog](https://github.com/scalar/scalar/blob/main/integrations/fastify/CHANGELOG.md) - [Commits](https://github.com/scalar/scalar/commits/HEAD/integrations/fastify) Updates `@sentry/node` from 10.53.1 to 10.55.0 - [Release notes](https://github.com/getsentry/sentry-javascript/releases) - [Changelog](https://github.com/getsentry/sentry-javascript/blob/develop/CHANGELOG.md) - [Commits](https://github.com/getsentry/sentry-javascript/compare/10.53.1...10.55.0) Updates `js-yaml` from 4.1.1 to 4.2.0 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](https://github.com/nodeca/js-yaml/commits) Updates `posthog-node` from 5.34.3 to 5.35.9 - [Release notes](https://github.com/PostHog/posthog-js/releases) - [Changelog](https://github.com/PostHog/posthog-js/blob/main/packages/node/CHANGELOG.md) - [Commits](https://github.com/PostHog/posthog-js/commits/posthog-node@5.35.9/packages/node) Updates `tsx` from 4.22.1 to 4.22.4 - [Release notes](https://github.com/privatenumber/tsx/releases) - [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs) - [Commits](https://github.com/privatenumber/tsx/compare/v4.22.1...v4.22.4) Updates `zxing-wasm` from 3.0.3 to 3.1.0 - [Release notes](https://github.com/Sec-ant/zxing-wasm/releases) - [Changelog](https://github.com/Sec-ant/zxing-wasm/blob/main/CHANGELOG.md) - [Commits](https://github.com/Sec-ant/zxing-wasm/compare/v3.0.3...v3.1.0) Updates `react` from 19.2.6 to 19.2.7 - [Release notes](https://github.com/facebook/react/releases) - [Changelog](https://github.com/facebook/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/facebook/react/commits/v19.2.7/packages/react) Updates `react-dom` from 19.2.6 to 19.2.7 - [Release notes](https://github.com/facebook/react/releases) - [Changelog](https://github.com/facebook/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/facebook/react/commits/v19.2.7/packages/react-dom) Updates `@sentry/react` from 10.53.1 to 10.55.0 - [Release notes](https://github.com/getsentry/sentry-javascript/releases) - [Changelog](https://github.com/getsentry/sentry-javascript/blob/develop/CHANGELOG.md) - [Commits](https://github.com/getsentry/sentry-javascript/compare/10.53.1...10.55.0) Updates `posthog-js` from 1.374.0 to 1.377.0 - [Release notes](https://github.com/PostHog/posthog-js/releases) - [Changelog](https://github.com/PostHog/posthog-js/blob/main/CHANGELOG.md) - [Commits](https://github.com/PostHog/posthog-js/compare/posthog-js@1.374.0...posthog-js@1.377.0) Updates `react-colorful` from 5.6.1 to 5.7.0 - [Release notes](https://github.com/omgovich/react-colorful/releases) - [Changelog](https://github.com/omgovich/react-colorful/blob/master/CHANGELOG.md) - [Commits](https://github.com/omgovich/react-colorful/commits/5.7.0) Updates `react-konva` from 19.2.3 to 19.2.4 - [Release notes](https://github.com/konvajs/react-konva/releases) - [Commits](https://github.com/konvajs/react-konva/compare/v19.2.3...v19.2.4) Updates `react-router-dom` from 7.15.1 to 7.16.0 - [Release notes](https://github.com/remix-run/react-router/releases) - [Changelog](https://github.com/remix-run/react-router/blob/main/packages/react-router-dom/CHANGELOG.md) - [Commits](https://github.com/remix-run/react-router/commits/react-router-dom@7.16.0/packages/react-router-dom) Updates `zustand` from 5.0.13 to 5.0.14 - [Release notes](https://github.com/pmndrs/zustand/releases) - [Commits](https://github.com/pmndrs/zustand/compare/v5.0.13...v5.0.14) --- updated-dependencies: - dependency-name: "@neplex/vectorizer" dependency-version: 0.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-deps - dependency-name: "@scalar/fastify-api-reference" dependency-version: 1.57.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-deps - dependency-name: "@sentry/node" dependency-version: 10.55.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-deps - dependency-name: js-yaml dependency-version: 4.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-deps - dependency-name: posthog-node dependency-version: 5.35.9 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-deps - dependency-name: tsx dependency-version: 4.22.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-deps - dependency-name: zxing-wasm dependency-version: 3.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-deps - dependency-name: react dependency-version: 19.2.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-deps - dependency-name: react-dom dependency-version: 19.2.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-deps - dependency-name: "@sentry/react" dependency-version: 10.55.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-deps - dependency-name: posthog-js dependency-version: 1.377.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-deps - dependency-name: react-colorful dependency-version: 5.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-deps - dependency-name: react-konva dependency-version: 19.2.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-deps - dependency-name: react-router-dom dependency-version: 7.16.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-deps - dependency-name: zustand dependency-version: 5.0.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-deps ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
SnapOtter
|
dfbc4cfd59 |
chore(release): 1.17.1
Bump version across all workspaces, update changelog, release notes, OpenAPI spec, bug report template, and OpenSSF badge answers. |
||
|
|
0bfbe31fe0 |
chore(deps-dev): bump the dev-deps group with 13 updates (#147)
Bumps the dev-deps group with 13 updates: | Package | From | To | | --- | --- | --- | | [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `2.4.8` | `2.4.15` | | [@playwright/test](https://github.com/microsoft/playwright) | `1.58.2` | `1.60.0` | | [@semantic-release/github](https://github.com/semantic-release/github) | `12.0.6` | `12.0.8` | | [@semantic-release/release-notes-generator](https://github.com/semantic-release/release-notes-generator) | `14.1.0` | `14.1.1` | | [jsdom](https://github.com/jsdom/jsdom) | `29.0.1` | `29.1.1` | | [turbo](https://github.com/vercel/turborepo) | `2.8.20` | `2.9.14` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `22.19.15` | `22.19.19` | | [@types/pdfkit](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/pdfkit) | `0.17.5` | `0.17.6` | | [@tailwindcss/vite](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-vite) | `4.2.2` | `4.3.0` | | [tailwindcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss) | `4.2.2` | `4.3.0` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `6.4.1` | `6.4.2` | | [vitepress-plugin-llms](https://github.com/okineadev/vitepress-plugin-llms) | `1.12.0` | `1.12.2` | | [@tailwindcss/postcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-postcss) | `4.2.4` | `4.3.0` | Updates `@biomejs/biome` from 2.4.8 to 2.4.15 - [Release notes](https://github.com/biomejs/biome/releases) - [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md) - [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.4.15/packages/@biomejs/biome) Updates `@playwright/test` from 1.58.2 to 1.60.0 - [Release notes](https://github.com/microsoft/playwright/releases) - [Commits](https://github.com/microsoft/playwright/compare/v1.58.2...v1.60.0) Updates `@semantic-release/github` from 12.0.6 to 12.0.8 - [Release notes](https://github.com/semantic-release/github/releases) - [Commits](https://github.com/semantic-release/github/compare/v12.0.6...v12.0.8) Updates `@semantic-release/release-notes-generator` from 14.1.0 to 14.1.1 - [Release notes](https://github.com/semantic-release/release-notes-generator/releases) - [Commits](https://github.com/semantic-release/release-notes-generator/compare/v14.1.0...v14.1.1) Updates `jsdom` from 29.0.1 to 29.1.1 - [Release notes](https://github.com/jsdom/jsdom/releases) - [Commits](https://github.com/jsdom/jsdom/compare/v29.0.1...v29.1.1) Updates `turbo` from 2.8.20 to 2.9.14 - [Release notes](https://github.com/vercel/turborepo/releases) - [Changelog](https://github.com/vercel/turborepo/blob/main/RELEASE.md) - [Commits](https://github.com/vercel/turborepo/compare/v2.8.20...v2.9.14) Updates `@types/node` from 22.19.15 to 22.19.19 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `@types/pdfkit` from 0.17.5 to 0.17.6 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/pdfkit) Updates `@tailwindcss/vite` from 4.2.2 to 4.3.0 - [Release notes](https://github.com/tailwindlabs/tailwindcss/releases) - [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.0/packages/@tailwindcss-vite) Updates `tailwindcss` from 4.2.2 to 4.3.0 - [Release notes](https://github.com/tailwindlabs/tailwindcss/releases) - [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.0/packages/tailwindcss) Updates `vite` from 6.4.1 to 6.4.2 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v6.4.2/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v6.4.2/packages/vite) Updates `vitepress-plugin-llms` from 1.12.0 to 1.12.2 - [Release notes](https://github.com/okineadev/vitepress-plugin-llms/releases) - [Commits](https://github.com/okineadev/vitepress-plugin-llms/compare/v1.12.0...v1.12.2) Updates `@tailwindcss/postcss` from 4.2.4 to 4.3.0 - [Release notes](https://github.com/tailwindlabs/tailwindcss/releases) - [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.0/packages/@tailwindcss-postcss) --- updated-dependencies: - dependency-name: "@biomejs/biome" dependency-version: 2.4.15 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-deps - dependency-name: "@playwright/test" dependency-version: 1.60.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-deps - dependency-name: "@semantic-release/github" dependency-version: 12.0.8 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-deps - dependency-name: "@semantic-release/release-notes-generator" dependency-version: 14.1.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-deps - dependency-name: jsdom dependency-version: 29.1.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-deps - dependency-name: turbo dependency-version: 2.9.14 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-deps - dependency-name: "@types/node" dependency-version: 22.19.19 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-deps - dependency-name: "@types/pdfkit" dependency-version: 0.17.6 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-deps - dependency-name: "@tailwindcss/vite" dependency-version: 4.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-deps - dependency-name: tailwindcss dependency-version: 4.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-deps - dependency-name: vite dependency-version: 6.4.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-deps - dependency-name: vitepress-plugin-llms dependency-version: 1.12.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-deps - dependency-name: "@tailwindcss/postcss" dependency-version: 4.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-deps ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
|
0dadca3b99 |
chore(deps): bump the production-deps group across 1 directory with 17 updates (#144)
Bumps the production-deps group with 17 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@scalar/fastify-api-reference](https://github.com/scalar/scalar/tree/HEAD/integrations/fastify) | `1.49.5` | `1.57.2` | | [@sentry/node](https://github.com/getsentry/sentry-javascript) | `10.49.0` | `10.53.1` | | [fflate](https://github.com/101arrowz/fflate) | `0.8.2` | `0.8.3` | | [p-queue](https://github.com/sindresorhus/p-queue) | `9.1.0` | `9.3.0` | | [posthog-node](https://github.com/PostHog/posthog-js/tree/HEAD/packages/node) | `5.29.5` | `5.34.2` | | [sharp](https://github.com/lovell/sharp) | `0.33.5` | `0.34.5` | | [tsx](https://github.com/privatenumber/tsx) | `4.21.0` | `4.22.1` | | [zxing-wasm](https://github.com/Sec-ant/zxing-wasm) | `3.0.2` | `3.0.3` | | [react](https://github.com/facebook/react/tree/HEAD/packages/react) | `19.2.4` | `19.2.6` | | [react-dom](https://github.com/facebook/react/tree/HEAD/packages/react-dom) | `19.2.4` | `19.2.6` | | [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `0.469.0` | `0.577.0` | | [@sentry/react](https://github.com/getsentry/sentry-javascript) | `10.49.0` | `10.53.1` | | [posthog-js](https://github.com/PostHog/posthog-js) | `1.370.0` | `1.373.5` | | [react-colorful](https://github.com/omgovich/react-colorful) | `5.6.1` | `5.7.0` | | [react-konva](https://github.com/konvajs/react-konva) | `19.2.3` | `19.2.4` | | [react-router-dom](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom) | `7.13.1` | `7.15.1` | | [zustand](https://github.com/pmndrs/zustand) | `5.0.12` | `5.0.13` | Updates `@scalar/fastify-api-reference` from 1.49.5 to 1.57.2 - [Release notes](https://github.com/scalar/scalar/releases) - [Changelog](https://github.com/scalar/scalar/blob/main/integrations/fastify/CHANGELOG.md) - [Commits](https://github.com/scalar/scalar/commits/HEAD/integrations/fastify) Updates `@sentry/node` from 10.49.0 to 10.53.1 - [Release notes](https://github.com/getsentry/sentry-javascript/releases) - [Changelog](https://github.com/getsentry/sentry-javascript/blob/develop/CHANGELOG.md) - [Commits](https://github.com/getsentry/sentry-javascript/compare/10.49.0...10.53.1) Updates `fflate` from 0.8.2 to 0.8.3 - [Release notes](https://github.com/101arrowz/fflate/releases) - [Changelog](https://github.com/101arrowz/fflate/blob/master/CHANGELOG.md) - [Commits](https://github.com/101arrowz/fflate/compare/v0.8.2...v0.8.3) Updates `p-queue` from 9.1.0 to 9.3.0 - [Release notes](https://github.com/sindresorhus/p-queue/releases) - [Commits](https://github.com/sindresorhus/p-queue/compare/v9.1.0...v9.3.0) Updates `posthog-node` from 5.29.5 to 5.34.2 - [Release notes](https://github.com/PostHog/posthog-js/releases) - [Changelog](https://github.com/PostHog/posthog-js/blob/main/packages/node/CHANGELOG.md) - [Commits](https://github.com/PostHog/posthog-js/commits/posthog-node@5.34.2/packages/node) Updates `sharp` from 0.33.5 to 0.34.5 - [Release notes](https://github.com/lovell/sharp/releases) - [Commits](https://github.com/lovell/sharp/compare/v0.33.5...v0.34.5) Updates `tsx` from 4.21.0 to 4.22.1 - [Release notes](https://github.com/privatenumber/tsx/releases) - [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs) - [Commits](https://github.com/privatenumber/tsx/compare/v4.21.0...v4.22.1) Updates `zxing-wasm` from 3.0.2 to 3.0.3 - [Release notes](https://github.com/Sec-ant/zxing-wasm/releases) - [Changelog](https://github.com/Sec-ant/zxing-wasm/blob/main/CHANGELOG.md) - [Commits](https://github.com/Sec-ant/zxing-wasm/compare/v3.0.2...v3.0.3) Updates `react` from 19.2.4 to 19.2.6 - [Release notes](https://github.com/facebook/react/releases) - [Changelog](https://github.com/facebook/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/facebook/react/commits/v19.2.6/packages/react) Updates `react-dom` from 19.2.4 to 19.2.6 - [Release notes](https://github.com/facebook/react/releases) - [Changelog](https://github.com/facebook/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/facebook/react/commits/v19.2.6/packages/react-dom) Updates `lucide-react` from 0.469.0 to 0.577.0 - [Release notes](https://github.com/lucide-icons/lucide/releases) - [Commits](https://github.com/lucide-icons/lucide/commits/0.577.0/packages/lucide-react) Updates `@sentry/react` from 10.49.0 to 10.53.1 - [Release notes](https://github.com/getsentry/sentry-javascript/releases) - [Changelog](https://github.com/getsentry/sentry-javascript/blob/develop/CHANGELOG.md) - [Commits](https://github.com/getsentry/sentry-javascript/compare/10.49.0...10.53.1) Updates `posthog-js` from 1.370.0 to 1.373.5 - [Release notes](https://github.com/PostHog/posthog-js/releases) - [Changelog](https://github.com/PostHog/posthog-js/blob/main/CHANGELOG.md) - [Commits](https://github.com/PostHog/posthog-js/compare/posthog-js@1.370.0...posthog-js@1.373.5) Updates `react-colorful` from 5.6.1 to 5.7.0 - [Release notes](https://github.com/omgovich/react-colorful/releases) - [Changelog](https://github.com/omgovich/react-colorful/blob/master/CHANGELOG.md) - [Commits](https://github.com/omgovich/react-colorful/commits/5.7.0) Updates `react-konva` from 19.2.3 to 19.2.4 - [Release notes](https://github.com/konvajs/react-konva/releases) - [Commits](https://github.com/konvajs/react-konva/compare/v19.2.3...v19.2.4) Updates `react-router-dom` from 7.13.1 to 7.15.1 - [Release notes](https://github.com/remix-run/react-router/releases) - [Changelog](https://github.com/remix-run/react-router/blob/main/packages/react-router-dom/CHANGELOG.md) - [Commits](https://github.com/remix-run/react-router/commits/react-router-dom@7.15.1/packages/react-router-dom) Updates `zustand` from 5.0.12 to 5.0.13 - [Release notes](https://github.com/pmndrs/zustand/releases) - [Commits](https://github.com/pmndrs/zustand/compare/v5.0.12...v5.0.13) --- updated-dependencies: - dependency-name: "@scalar/fastify-api-reference" dependency-version: 1.57.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-deps - dependency-name: "@sentry/node" dependency-version: 10.53.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-deps - dependency-name: "@sentry/react" dependency-version: 10.53.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-deps - dependency-name: fflate dependency-version: 0.8.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-deps - dependency-name: lucide-react dependency-version: 0.577.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-deps - dependency-name: p-queue dependency-version: 9.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-deps - dependency-name: posthog-js dependency-version: 1.373.5 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-deps - dependency-name: posthog-node dependency-version: 5.34.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-deps - dependency-name: react dependency-version: 19.2.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-deps - dependency-name: react-colorful dependency-version: 5.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-deps - dependency-name: react-dom dependency-version: 19.2.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-deps - dependency-name: react-konva dependency-version: 19.2.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-deps - dependency-name: react-router-dom dependency-version: 7.15.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-deps - dependency-name: sharp dependency-version: 0.34.5 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-deps - dependency-name: tsx dependency-version: 4.22.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-deps - dependency-name: zustand dependency-version: 5.0.13 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-deps - dependency-name: zxing-wasm dependency-version: 3.0.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-deps ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
SnapOtter
|
3e06d68f4f |
chore: bump version to 1.17.0 and update docs for release
- Bump all workspace package versions to 1.17.0 - Update APP_VERSION constant and OpenAPI spec - Update AI tool count from 15 to 16 across docs and i18n - Update tool table with AI Canvas Expand, Meme Generator, Beautify - Add image editor, OIDC, and 20 languages to README features - Add release notes for v1.17.0 - Add JSON-LD structured data and SEO improvements to landing/docs |
||
|
SnapOtter
|
ca2ef5b3f4 |
feat: add OIDC/SSO authentication (#3)
Add OpenID Connect (OIDC) authentication alongside existing username/password login. Users can log in via any standards-compliant OIDC provider (Keycloak, Authentik, Authelia, Google, Azure AD, Okta) while preserving full backward compatibility. - OIDC Fastify plugin with lazy discovery, PKCE, cookie-based sessions - Login page OIDC button, auth hook updates, settings dialog badges - 28 integration tests, OIDC setup guide with provider examples - Fix pre-existing test failures (content-aware-crop, watermark, SVGZ) - WAL checkpoint fix for SQLite test stability Closes #3 # Conflicts: # apps/api/src/lib/env.ts # apps/api/src/routes/tools/watermark-image.ts # pnpm-lock.yaml # tests/integration/color-palette.test.ts # tests/integration/compare.test.ts # tests/integration/watermark-image.test.ts |
||
|
SnapOtter
|
20ab04c5bd |
fix(security): revert archiver v8 and @fastify/static v9 upgrades
archiver v8 changed its default export, breaking all ZIP-producing tools (pdf-to-image, split, batch, favicon, bulk-rename, svg-to-raster). Reverted to v7 -- the lodash vulnerability via archiver is _.template which is never called directly. @fastify/static v9 has breaking changes incompatible with the current static file serving setup. Reverted to v8 -- the path traversal CVEs in v8 are mitigated by the existing path traversal guards in files.ts. Updated edge-cases test to expect 400 for >64KB settings payloads (new security limit). |
||
|
SnapOtter
|
4e64ee2779 |
fix(security): comprehensive security audit and hardening
Auth: login rate limit 30/min (was 500), global rate limit 1000/min (was unlimited), password/username max lengths on all Zod schemas, session invalidation on role change, API key legacy scan bounded to 100 keys. SVG: hardened regex sanitizer with CDATA stripping, XML entity decoding, set/animate/iframe/embed blocking, comprehensive data: URI blocking, use element external href blocking. 11 attack payload fixtures added. SSRF: fixed DNS rebinding TOCTOU by pinning resolved IPs via custom HTTP/HTTPS agents. Added 6to4 and NAT64 to blocked IPv6 ranges. Docker: capability dropping (cap_drop ALL + minimal cap_add), resource limits (4g/8g mem, 512/1024 pids), healthcheck timeout, password removed from startup banner, default password warning comments. Network: CSP and HSTS applied in all environments (not just production), stack traces removed from all error responses, internal paths stripped from error details, per-route rate limits on uploads (60/min) and URL fetches (200/hour). Files: exclusive temp file creation (O_EXCL), disk space circuit breaker, per-user storage quotas, settings payload 64KB size guard. Python sidecar: script name allowlist in dispatcher, minimal environment for subprocess spawns. Dependencies: fixed 6 production CVEs (drizzle-orm, fastify, fast-uri, @fastify/static, next, archiver/lodash). Pinned all GitHub Actions to SHA hashes. 114 security tests added. Full OWASP Top 10 penetration test matrix verified against production Docker container (30/30 pass after hardening). |
||
|
SnapOtter
|
446bad3b10 | feat(oidc): install openid-client and @fastify/cookie | ||
|
SnapOtter
|
78ca9720e7 | fix: sync all workspace package versions to 1.16.0 | ||
|
SnapOtter
|
53b717243b | fix(meme-generator): add opentype.js types, fix no-dropzone registry test | ||
|
SnapOtter
|
180ec6edfb | chore: add opentype.js dependency for meme text rendering | ||
|
SnapOtter
|
0309e0f680 |
chore: deploy to Cloudflare Pages and update branding
- Add Cloudflare Pages deployment for landing page (snapotter.com) and docs (docs.snapotter.com) - Create deploy-landing.yml and update deploy-docs.yml workflows - Update CI to ignore apps/landing/** paths - Fix logo transparency (remove white background) across all apps - Recreate social-preview.png with SnapOtter branding - Update all docs URLs from GitHub Pages to docs.snapotter.com - Update VitePress config: light theme default, fix llms.txt paths - Add .vitepress/cache/ and .env.* to gitignore |
||
|
ashim-hq
|
075f017dbf | feat: add backend analytics wrapper, config/consent API routes | ||
|
ashim-hq
|
ae411f2d72 | chore(release): 1.15.9 [skip ci] | ||
|
semantic-release-bot
|
95af281584 |
chore(release): 1.15.8 [skip ci]
## [1.15.8](https://github.com/ashim-hq/ashim/compare/v1.15.7...v1.15.8) (2026-04-17)
### Bug Fixes
* copy Node.js from official image instead of apt-get install ([
|
||
|
semantic-release-bot
|
caa2160ef8 |
chore(release): 1.15.7 [skip ci]
## [1.15.7](https://github.com/ashim-hq/ashim/compare/v1.15.6...v1.15.7) (2026-04-17)
### Bug Fixes
* add retry with backoff for apt-get update on CUDA base image ([
|
||
|
semantic-release-bot
|
23dae8d152 |
chore(release): 1.15.6 [skip ci]
## [1.15.6](https://github.com/ashim-hq/ashim/compare/v1.15.5...v1.15.6) (2026-04-17)
### Performance Improvements
* parallelize model downloads and switch to registry cache ([
|
||
|
semantic-release-bot
|
2fd0c00564 |
chore(release): 1.15.5 [skip ci]
## [1.15.5](https://github.com/ashim-hq/ashim/compare/v1.15.4...v1.15.5) (2026-04-17)
### Bug Fixes
* exclude e2e-docker tests from Vitest runner ([
|
||
|
semantic-release-bot
|
3dc98374e2 |
chore(release): 1.15.4 [skip ci]
## [1.15.4](https://github.com/ashim-hq/ashim/compare/v1.15.3...v1.15.4) (2026-04-17) ### Bug Fixes * verbose error handling, batch processing, and multi-file support ([ |
||
|
semantic-release-bot
|
b76b9a1878 |
chore(release): 1.15.3 [skip ci]
## [1.15.3](https://github.com/ashim-hq/ashim/compare/v1.15.2...v1.15.3) (2026-04-16)
### Bug Fixes
* retry apt-get update on transient mirror sync errors (Acquire::Retries=3) ([
|